SPULICO
AI security and EU AI Act compliance

We secure AI that acts on its own.

We threat-model, test and harden systems built on agents and LLMs. We set traps that expose an attacker before they reach your data, and help you meet the requirements of the EU AI Act.

Get in touch See services

Four practices, one focus.

01

Agentic AI security

Reviews and adversarial testing of agents, tools and MCP servers: prompt injection, tool misuse, excessive agency and privilege escalation across tool chains.

02

Threat modeling

Audit-grade threat models for LLM, RAG and agentic systems, with every control linked to the EU AI Act obligation it supports.

OWASP LLM MITRE ATLAS MAESTRO
03

Deception for AI

Decoy tools, canary documents in your RAG store and honeytokens in agent memory. They raise the alarm the moment someone tries to steer your system.

04

EU AI Act consulting

We determine your system's risk category and the obligations that follow. Then we help you build the risk management, technical documentation and controls you need to demonstrate compliance.

EU AI Act ISO/IEC 42001

How we work

  1. 01 · SCOPE

    We map your architecture, trust boundaries and key assets.

  2. 02 · MODEL

    We build the threat model and rank the attack paths.

  3. 03 · TEST

    We verify those paths against your live system.

  4. 04 · PROTECT

    We hand over concrete fixes and deploy the traps.

Frequently asked questions

Is my system high-risk AI?

It depends on the use case, not the technology. The AI Act treats as high-risk, among others, AI used in recruitment, credit scoring, education and critical infrastructure (Annex III), and AI that is a safety component of regulated products (Annex I). A chatbot or assistant is usually subject only to transparency obligations. We help you determine the classification and document it.

When do AI Act requirements apply?

Prohibited practices have applied since 2 February 2025, general-purpose model obligations since 2 August 2025 and transparency obligations since 2 August 2026. Following the Digital Omnibus amendment, high-risk requirements apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems.

Does the AI Act apply if I use an off-the-shelf model?

Yes, though to a different extent. The AI Act places obligations not only on model providers but also on deployers. If you build your own product on someone else's model, for example via an API, you may count as the provider of an AI system under the regulation.

How is an AI security test different from a classic pentest?

A classic pentest covers the application and infrastructure. An AI system test also covers how the model and agent behave: prompt injection, tool misuse, data leakage through RAG and agent memory manipulation. We combine both.

What is deception for AI?

Traps built into your system: decoy tools, canary documents and honeytokens. Legitimate users never touch them, so any use is a signal of attack, with almost no false positives.

Building with AI? Let's talk.

Tell us briefly about your system. We work in Polish and English.

team@spulico.com